Privacy Policy | HungryShot

1. Who We Are

HungryShot ("we", "our", "us") is an AI-powered photo and video studio that helps restaurants, cafés, bars, bakeries, cloud kitchens, food trucks and caterers turn photos of their dishes into menu-ready, delivery-app-ready and social-media-ready images and videos. HungryShot is a software by [Company legal name], [legal form], registered office: [Registered address], registration number [Registration number], website https://hungryshot.com.

[Company legal name] is the data controller for the personal data of visitors and account holders. For the dish photos, menus, logos and other content you upload, we process them on your behalf only to deliver the Service.

For any question about this policy, contact us at contact@hungryshot.com.

2. Data We Collect

We collect:

Account information: name, email address, and password (hashed) when you register.

Content you upload: dish photos, menus, logos and other brand assets, and the text you enter (dish names, descriptions, custom instructions). Files saved in your private account library remain stored until you delete them or delete your account. Some features may create temporary copies while processing content.

Technical data: IP address, browser, device type and security logs, collected on our servers to operate and secure the Service.

Billing data: payments are processed by Stripe. Stripe collects your payment details, name, email, billing country and, where required, tax information, and shares with us the payment status, plan, country and the brand and last digits of the payment method. We never see or store your full card number.

Communications: any messages you send us via email or support chat.

3. How We Use Your Data

Your data is used to:

Provide and improve the HungryShot service.

Process your uploaded dish photos and brand assets through our AI models to create the images, videos and menu copy you request.

Send transactional emails (account confirmation, receipts, support).

Secure the Service and prevent fraud and abuse.

Comply with legal obligations.

We do NOT sell your personal data to third parties, we do NOT use it for advertising, and we do NOT use your dish photos, menus or brand assets to train AI models without your explicit consent.

4. Legal Basis (GDPR)

For EU/EEA users, we process your data under the following legal bases:

Contract performance: processing your dish photos and generating images, videos and menu copy.

Legitimate interests: security and fraud prevention.

Consent: marketing communications (opt-in only).

Legal obligation: tax records and compliance.

5. Data Retention

Files saved in your account: until you delete them or delete your account.

Account and profile data: while your account remains open. When you delete your account, we delete saved content from active systems, except records we must retain by law; backup copies may remain until overwritten in our normal backup cycle.

Billing records: 7 years (legal obligation).

6. Data Sharing

We share data only with:

[Hosting provider] ([Country]) – hosting of the application on our virtual private server

Neon – database

Cloudflare R2 – file storage

Stripe (Ireland / United States) – payment processing, fraud prevention and invoicing. Stripe acts as an independent controller for some of this processing; see https://stripe.com/privacy

Google (Gemini) and Replicate – AI processing of text and images

Resend – transactional emails

Legal authorities – only when required by law

All sub-processors are contractually bound to GDPR-compliant data handling.

7. International Transfers

[Company legal name] is based in [Country] and some of our providers process data outside the European Economic Area and the United Kingdom, including in the United States. Where this happens, we rely on an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or on Standard Contractual Clauses and equivalent safeguards, together with supplementary measures where needed. You can ask us for a copy of the safeguards at contact@hungryshot.com.

8. AI Processing and Uploaded Content

Dish photos, brand assets and text instructions you submit are sent to AI providers (Google Gemini and Replicate) only to produce the result you asked for. For personal data contained in your uploads (for example, a chef, staff member or diner who appears in a photo), you act as the controller and must have the right and, where required, the consent of that person to upload it; we process it on your behalf under your instructions. Please do not upload photos of identifiable people other than yourself unless you have their permission. AI-generated chefs, diners and other people are synthetic and are not based on any real person. We do not make decisions about you that produce legal or similarly significant effects solely by automated means.

9. Your Rights

Under GDPR (and applicable laws), you have the right to:

Access the personal data we hold about you

Correct inaccurate data

Delete your account and associated data

Export your data in a portable format

Object to processing or withdraw consent

Lodge a complaint with your national data protection authority

Exercise these rights by emailing contact@hungryshot.com. We respond within 30 days.

California and other US state residents: you may have the right to know, access, correct, delete and port your personal information and to opt out of its sale or sharing. We do not sell or share personal information for cross-context behavioural advertising, and we will not discriminate against you for exercising your rights. Residents of other regions (for example Brazil, Switzerland, Canada) may exercise equivalent rights under their local laws using the same contact.

10. Children

The free plan is not intended for people under 16 and paid plans are not intended for people under 18. If you believe a child has given us personal data, contact contact@hungryshot.com and we will delete it.

11. Cookies

We only use strictly necessary and functional cookies (session, language, referral code), plus the cookies that Stripe sets on its checkout for payment security and fraud prevention. We do not use analytics or advertising cookies. See our Cookie Policy for full details.

12. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, regular security reviews, and strict internal access controls. No method of transmission over the internet is 100% secure. If you discover a vulnerability, please report it responsibly to contact@hungryshot.com.

13. Changes to This Policy

We may update this policy periodically. We'll notify registered users by email of material changes at least 14 days before they take effect. Continued use of HungryShot after that date constitutes acceptance.